Zero-Trust-Communication

Overview

The repository contains test cases demonstrating the application of Zero Trust (ZT) architecture in an IoT-Edge-Cloud continuum. The test cases represent a simulated CCTV monitoring system that utilizes edge computing for image processing (object detection) before securely transmitting the data to a cloud-based database for storage and analysis.

System Architecture

The test environment consists of:

1. IoT Device: A CCTV camera acting as a client that sends images to the edge microservices for processing.

2. Edge System: Composed of several microservices that perform image processing tasks (e.g., object detection).

3. Cloud System: A cloud-based database that stores the processed images for further analysis.

Test Scenario

• Objective: To demonstrate Bthe application of ZT architecture in an IoT-Edge-Cloud environment.

• Components:

  • Windows machine: Functions as the IoT device, communicating with the edge system.
  • Ubuntu machine:
    • Runs the OpenZiti overlay network.
    • Acts as the edge system, processing the images received from the IoT device.

• ZT implementation:

  • Utilizes the OpenZiti framework to create a secure overlay network between the IoT device and the edge system.

• Stakeholders:

  • Security company: Owns and operates image processing microservices on the Edge
  • Client: Owns the CCTV camera and cloud DB where observed data is stored

Setup Steps

• Setup the overlay network on the Ubuntu machine according to the Local - No Docker.

• Also on the Ubuntu machine, follow the Your First Service guide as below:

  1. Create an identity for the HTTP client and assign an attribute "http-clients". We'll use this attribute when authorizing the clients to access the HTTP service
  2. Create an identity for the HTTP server if you are not using an edge-router with the tunneling option enabled. Also note that if you are using the docker-compose quickstart or just plan to use an edge-router with tunneling enabled you can also skip this step.
  3. Create an intercept.v1 config. This config is used to instruct the client-side tunneler how to correctly intercept the targeted traffic and put it onto the overlay.
  4. Create a host.v1 config. This config is used to instruct the server-side tunneler how to offload the traffic from the overlay, back to the underlay.
  5. Create a service to associate the two configs created previously into a service.
  6. Create a service-policy to authorize "HTTP Clients" to "dial" the service representing the HTTP server.
  7. Create a service-policy to authorize the "HTTP Server" to "bind" the service representing the HTTP server.
  8. Start the server-side tunneler with the HTTP server identity, providing access to the HTTP server.
  9. Start the client-side tunneler from the Windows machine using the HTTP client identity by:
     • Copy the http.client.jwt from step 1 to the Windows machine.
     • Enroll the client identity using ziti-edge-tunnel binary.
     • Run the ziti-edge-tunnel for the client.
  10. Access the HTTP server securely over the OpenZiti zero trust overlay

Encountered Issues

• Problem: "CONTROLLER_UNAVAILABLE" error when trying to enroll the client identity on the Windows machine.

  • Cause: DNS issue - The Windows machine could not resolve the host name of the Ubuntu machine.
  • Solution: Added a new entry (the Ubuntu machine's IP address and hostname) in the /etc/hosts on the Windows machine side.

• Problem: Unauthorized computer can still access the HTTP server.

  • Cause: Incorrect configuration at step 3 and 4?

• Problem: Ziti Admin Console (ZAC) not discovering the controller.